3280 matches found
CVE-2021-38569
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects...
PT-2021-22215
Name of the Vulnerable Software and Affected Versions Foxit PDF Reader versions prior to 11.0.1 Foxit PDF Editor versions prior to 11.0.1 Description An issue in the software allows stack consumption during recursive processing of embedded XML nodes. Recommendations For Foxit PDF Reader versions...
Foxit Reader和Foxit PhantomPDF 安全漏洞
Foxit Reader and Foxit PhantomPDF are both PDF document readers from Foxit, a Chinese company. Foxit Reader and PhantomPDF versions prior to 10.1.4 contain a security vulnerability that could be exploited by an attacker to invoke the stack via a recursive function during the processing of XFA for...
Prototype Pollution
Overview com.graphhopper:graphhopper-web-bundle is a GraphHopper routing engine as a web-service Affected versions of this package are vulnerable to Prototype Pollution. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload. P...
OpenSSL DoS Vulnerability (20180327) - Windows
OpenSSL is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...
OpenSSL DoS Vulnerability (20180327) - Linux
OpenSSL is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...
EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2021-2157)
According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment...
XML2Dict XML Entity Expansion Vulnerability
XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references...
GHSA-GP6M-VQHM-5CM5 XML2Dict XML Entity Expansion Vulnerability
XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references...
Advisory ROSA-SA-2021-1941
Software: orc 0.4.26 OS: Cobalt 7.9 CVE-ID: CVE-2018-8015 CVE-Crit: HIGH CVE-DESC: In Apache ORC 1.0.0-1.4.3, a corrupted ORC file can trigger an infinitely recursive function call in a C ++ or Java parser. The consequence of this error is likely to be a denial of service for software that uses t...
Moderate: Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.20.4 security update
An update is now available for Red Hat OpenShift Jaeger 1.20. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...
Prototype Pollution
Overview record-like-deep-assign is a Recursively assigns enumerable own properties of the given sources to a target object Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const deepAssign = require'record-like-deep-assign'; let obj = ;...
Prototype Pollution
Overview lutils is an A few reliable utils. Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. PoC const lt = require'lutils'; let obj = ; console.log"Before being polluted: " + obj.polluted; var EVILJSON = JSON.parse'"proto":"polluted":true';...
Prototype Pollution
Overview @ianwalter/merge is a Recursively merge JavaScript Objects Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead. PoC const merge = require'@ianwalter/merge'; let obj = ; console.log"Before...
curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used
Libcurl offers a wildcard matching functionality, which allows a callback set with CURLOPTCHUNKBGNFUNCTION to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns...
curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used
Libcurl offers a wildcard matching functionality, which allows a callback set with CURLOPTCHUNKBGNFUNCTION to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns...
Prototype Pollution
Overview merge-change is a Deep merge of objects and other types, also for patches and immutable updates. Affected versions of this package are vulnerable to Prototype Pollution via the utils.set function. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution...
Prototype Pollution
Overview nedb is an embedded persistent or in memory database for Node.js, nw.js, Electron and browsers, 100% JavaScript, no binary dependency. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of...
CVE-2021-32623: Improper Restriction of Recursive Entity References in DTDs
Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast usin...